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REMARKS 

The Examiner has rejected each of the claims under 35 U.S.C. 103(a) as being 
unpatentable over Chess et al. (USPN 6,71 1,583) in view of Smithson (USPN 6,886,099). 
Applicant respectfully disagrees with such rejection. 

Specifically, the Examiner has relied on the following excerpts from Chess to 
meet applicant's claimed "logging code operable to maintain a statistical log having an 
entry for each file sent to the computer for review, each entry being arranged to store a 
count value indicating the number of times that the file has been sent to the computer for 
review and a value of one or more predetermined attributes relating to the file" (see this 
or similar, but not necessarily identical language in each of the independent claims). 

"When the anti-virus program 201 begins a scan of the syatem 100, 
either in response to user input from, for example, a terminal 
205 or due to the expiration of a, preferably periodic, timer 
206, the anti-virus program 201 invokes the generic document- 
virus detection and repair module 202. Alternatively, the scan 
can be initiated in response to a document changing event such as 
each occurrence of a document changing, an Nth occurrence of a 
document changing (where 1? is some positive integer value) or a 
certain number of documents having changed." <col. 5, line 62 - 
col. 6, line 5) 

After carefully reviewing the above excerpt and the remaining references, for that 
matter, it is apparent that the references relied upon by the Examiner only track a single 
value, namely a number of occurrences of a document changing. In contrast, applicant 
teaches and claims logging two values, namely "a count value indicating the number of 
times that the file has been sent to the computer for review and a value of one or more 
predetermined attributes relating to the file" (emphasis added). To this end, the 
Examiner's proposed combination fails to meet applicant's claimed count value 
indicating the number of times that the file has been sent to the computer for review . It 
should be noted that tracking a number of occurrence a document has been changed does 
not equate to a number of times thai a file has been sent to the computer for review . 

Still yet, the Examiner has relied on the following excerpts et al. from Chess to 
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meet applicant's claimed "statistical log interface code operable, upon receipt of a file, to 
determine with reference to the statistical log the count value relating to that file; action 
determination code operable, if the count value determined by the statistical log interface 
code exceeds a predetermined threshold" (see this or similar, but not necessarily identical 
language in each of the independent claims). 



"After the viral set or sets have been established in step 312* 
control passes to step 314, in which the system determines 
whether there are any viral sets containing one or more macros. 
If there are no such viral sets, e.g., the set of names is empty, 
the module 202 returns with no action. Otherwise, if that set of 
names {viral set(s)) is not empty, the module concludes chat, for 
each such viral set, a virus consisting of a set of macros with 
these names (or the macros in that set) may have infected the 
system and the user is informed and asked if repair should be 
carried out in step 316. If, in step 316, a message is received 
indicating that the user replied in the affirmative, the method 
continues in FIG. 3C. If, however, the user does not request a 
repair, the method ends." (col, 6, lines 15-28) 



As set forth earlier, the Examiner's proposed combination fails to even suggest 
any sort of count value indicating the number of times that the file has been sent to the 
computer for review , To this end, it is impossible for the reference to meet applicant's 
claimed technique used to "determine with reference to the statistical log the count value 
relating to that file. " let alone a condition regarding whether "the count value determined 
by the statistical log interface code exceeds a predetermined threshold" (emphasis added), 
as claimed, After carefully reviewing the above excerpt and the remaining references, for 
that matter, it is apparent that there is only a teaching of a determination as to whether a 
macro is infected. There is not, however, any sort of determination whether a count value 
indicating the number of times that the file has been sent to the computer for review 
exceeds a predetermined threshold * 



Even still, the Examiner has relied on the following excerpts et al. from Smithson 
to meet applicant's claimed "weighting indicating the likelihood that a file having that 
value of said one or more predetermined attributes will be malware" and "referenc[ing] 
the weighting table to determine the weighting to be associated with the file, based on the 
value of said one or more predetermined attributes associated with that file in the 
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statistical log" (see this or similar, but not necessarily identical language in each of the 
independent claims). 

*The computer program executing on the computer system of PIG. 2 
seeks to detect a virus outbreak by monitoring one or more 
measurement parameters obtained over a measurement period against 
predetermined threshold levels. This process is illustrated in 
FIG. 3. PIG. 3 shows four measurement parameters with their 
associated (user controlled) threshold levels Thl, Th2, Th3 and 
Th4 . The computer program periodically checks each of the 
measurement parameters against its respective threshold to 
determine if that threshold has been crossed. In the case of the 
measurement parameters 1/ 2 and 4, the normal state for these 
measurement parameters is less than their respective threshold 
values. Conversely, the normal state for the measurement 
parameter 3 is greater than its threshold value." (col. 4, lines 
5-20) 

The foregoing excerpt from Smithson discloses thresholds, not weights as claimed 
by applicant. Further, Smithson's measurement parameters and thresholds are associated 
with aggregate file activity , not a particular file. To this end, Smithson simply fails to 
meet applicant's claimed "referencpng] the weighting table to determine the weighting to 
be associated with the file, based on the value of said one or more predetermined 
attributes associated wit h that file in the statistical log " (emphasis added). 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success, Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.1991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fait 
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to teach or suggest all of the claim limitations, as noted above. Thus, a notice of 
allowance or a specific prior art showing of all of applicant's claim limitations, in 
combination with the remaining claim elements, is respectfully requested. 



Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. For example, with respect to Claim 1 1 et aL, the Examiner has relied 
on the following excerpts from the Smithson reference to make a prior art showing of 
applicant's claimed "each entry in the statistical log . . . further arranged to identify, for 
each sender of that file, the number of times that that sender has sent the file in addition 
to the count value indicating the total number of times that the file has been sent" (see 
this or similar, but not necessarily identical language in each of the independent claims). 



"As preferred examples of the measurement parameters that may be 
used there are proposed; 

1. How many E-mail messages are sent having an identical 
message title. 

2. How many E-mail messages are sent identical file attachment. 

3 . How many email messages are sent having a file attachment of a 
given file type. 

4. How many E-mail messages are sent having a file attachment 
that is an executable file. 

5. The E-mail through put within the computer system. 

6. The E-mail throughput measured in a form dependent upon a 
number of E-mails multiplied by a total size for the E-mails." 
(Col. 4, lines 25-40) 



Again, as noted above, Smithson' s measurement parameters and thresholds are 
associated with aggregate file activity , not a particular file. To this end, Smithson simply 
fails to meet applicants claimed dumber of times that that sender has sent the file in 
addition to the count value indicating the total number of times that the file has been 
sent." It is further noted that the measurement parameters does not track a per-sender 
number, and thus fails to meet applicant's claimed "each entry in the statistical log . 
further arranged to identify, for each sender of that file, the number of times that that 
sender has sent the file in addition to the count value indicating the total number of times 
that the file has been sent' * (emphasis added). 



Thus, only applicant teaches and claims use of both 1) a number of times that a 
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particular sender has sent a file, and 2) a total number of times the file has been sent 
irrespective of sender in each entry in the statistical log. Note Table I below which 
illustrates such claimed subject matter. 

Table I 

Entry_l (associated with filej) 
Sender_l 

Number of times file_l is sent by SenderJ 
Sender_2 

Number of times file J is sent by Sender_2 
Total number of times file_l is sent 

Entry_2 (associated with file_2) 

Sender_l 

Number of times file_2 is sent by Sender_l 
Sender_2 

Number of times file_2 is sent by Sender_2 
Total number of times file_2 is sent 

Again, a notice of allowance or a specific prior art showing of all of applicant's 
claim limitations, in combination with the remaining claim elements, is respectfully 
requested. 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
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application, the Examiner may reach the undersigned at (408) 505-5100. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P484/01.103.01). 



P.O. Box 721120 

San Jose, CA 95 172-1 120 

408-505-5100 
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